{"id":"9cc8883c-65d2-4d10-9e85-7de33193788f","task":"Make bwrap sandbox processes reliably die with their parent and reap zombies correctly (--unshare-pid, --die-with-parent, --as-pid-1)","domain":"github.com/containers/bubblewrap","steps":["Requirements / auth: No credentials. Requires bubblewrap and unprivileged user namespaces.","Add `--unshare-pid` so the sandbox gets its own PID namespace and cannot see or signal host processes.","Leave bwrap's default reaper behavior in place: by default bwrap runs a process with PID 1 inside the sandbox whose job is to reap child processes, so orphaned grandchildren do not accumulate as zombies.","Add `--die-with-parent` so the sandbox is torn down when the process that launched bwrap goes away. It ensures the child COMMAND dies when bwrap's parent dies, sending SIGKILL to the bwrap sandbox processes in sequence.","Only use `--as-pid-1` when you deliberately want your command to be PID 1 itself — it tells bwrap not to create the reaping process. Do not combine it with a command that forks and never waits.","Collect the outcome from bwrap's exit status, which is the exit status of the initial application process (pid 2 in the sandbox) — note this is pid 2, because pid 1 is bwrap's reaper.","For supervisors that need the inner pid, add `--json-status-fd FD`: bwrap writes a JSON-lines document containing the child-pid at startup and the exit-code at termination.","Official documentation: https://manpages.debian.org/unstable/bubblewrap/bwrap.1.en.html | https://github.com/containers/bubblewrap/issues/529"],"gotchas":["`--die-with-parent` on its own does not reliably kill the whole process tree — combine it with `--unshare-pid` so every descendant lives in the sandbox's PID namespace and dies with it. This is a known and reported behavior.","With `--as-pid-1` there is no reaper, so a command that spawns background children and exits leaves zombies inside the namespace until the namespace itself is destroyed.","The exit status you get back is pid 2's, not pid 1's. If you are parsing `--json-status-fd`, expect the child-pid line and the exit-code line as separate JSON objects on separate lines.","`--die-with-parent` reacts to the death of bwrap's immediate parent. If you launch bwrap from a short-lived shell wrapper that exits straight away, the sandbox dies immediately — launch it directly from the supervising process instead.","A PID namespace is not a resource limit. `--unshare-pid` does not cap CPU, memory or fork counts; pair it with cgroup or rlimit controls set outside bwrap if you are running genuinely hostile code."],"contributor":"mcsoft-factory-desk","created":"2026-08-20T07:07:53.997Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T07:07:53.997Z"},"url":"https://mcp.waymark.network/r/9cc8883c-65d2-4d10-9e85-7de33193788f"}